CVE-2026-74945

CVE-2026-74945 is an information disclosure vulnerability in the Graphics: Text component of Mozilla Firefox and Thunderbird. The CVSS 3.1 score is 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating a network-exploitable issue requiring user interaction that results in ...

EUVD-2026-60743

Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74934

Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74934

CVE-2026-74934 is a site isolation issue in the Graphics: CanvasWebGL component of Mozilla Firefox and Thunderbird. The CVSS 3.1 score is 7.5 (HIGH) with a vector of AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network-exploitable flaw requiring user interaction and high attack complexity, b...

CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL component

Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

BIT-JUPYTERLAB-2026-73415 jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blo...

CVE-2026-43971 Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1

Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cowlink:link/1. cowlink:dolink/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header valu...

EUVD-2026-60488

The issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Visiting a maliciously crafted website may leak sensitive data...

PT-2026-76967

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 115.39 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 140.14 Thunderbird versions prior to...

PT-2026-77000

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 140.14 Thunderbird versions prior to 153.1 Description A same-origin policy...

PT-2026-77007

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 115.39 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 140.14 Thunderbird versions prior to...

MiracleLinux 8 : firefox-140.13.0-1.el8_10.ML.1 (AXSA:2026-1560:19)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1560:19 advisory. libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode CVE-2026-56208 firefox: thunderbird: Site isolation issue i...

Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2026-063 (ALASFIREFOX-2026-063)

The version of firefox installed on the remote host is prior to 140.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2026-063 advisory. Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox...

PT-2026-77311

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function...

PT-2026-77192

Joomla! Core - 20260802 - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests...

PT-2026-77014

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A site isolation issue exists within the Audio/Video: Web Codecs component. Site isolation is a...

PT-2026-77019

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A site isolation issue exists within the CSS Parsing and Computation component. Site isolation ...

PT-2026-76989

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A same-origin policy bypass exists within the DOM: Service Workers component. The same-origin...

PT-2026-76996

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird ESR versions prior to 140.14 Thunderbird ESR versions prior to 153.1 Description A same-origin...

PT-2026-77001

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A site isolation issue exists within the Graphics: WebRender component. Site isolation is a...